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Abstract— The deep space and the stunning level of sophistication of cyberattacks on critical 
infrastructures, facilities and services on which our contemporary existence has become increasingly 
dependent, is cause for great concern. Even though a great deal goes unreported, the reports available so 
far is alarming. What this implies is that we are existing at the precipice of a cyber-holocaust, it appears 
that the threats posed by these occurrences are not properly understood by the relevant stakeholders and 
the society in general. In this study, confirmed occurrences of successful cyber-attacks are presented in an 
extensive literature review. And based on this review pertinent data from secondary sources that have a 
keen interest in ensuring a secure cyber space is used to highlight subsisting and persisting threats. The 
information is also used to show future threats as regards the security of cyber space as the world 
anticipates intensification of cyber-attacks especially among state actors, as well as sophisticated corporate 
syndicates and highly motivated knowledgeable groups and individuals. From the analysis it appears that 
the approaches currently put in place to check/mitigate the incidence of cyber-attacks are not producing 
veritable results. Consequently, this study suggests the need to develop frameworks that will support multi 
and trans disciplinary approaches to the problem as well as improve/ enhance treaties among nations and 


the need for nations and corporate institutions and to take responsibility for cyber escalation. 


Keywords— Cyberspace, cybersecurity, critical infrastructure, cybercrime, transdisciplinary cyber- 


frameworks, threat actors. 


I. INTRODUCTION 


We are becoming increasingly dependent on technology, and this increased dependency is fuelled by the 
convenience provided by information technology which has automatically given rise to an alternative space 
(cyber space). We are now living in a dual space system which consists of the physical space as well as the 
cyber space, going by the blitzing pace of technology and innovation, we are tilted more towards cyber 
space than the physical space, for example governments, corporate institutions, individuals and some 
entire components of some cities interact more with cyber space than with the physical space that used to 
be the norm. Technologies like Internet of Things (IOT) have introduced another dimension to how we use 
cyberspace. With this increasing dependency and mushrooming threats, most of which go unreported the 
world is on a delicate balance that requires in depth study and analysis to guarantee future survival. It is 


already established that the war between states now and in future are and will be cyber based, there are 
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well established institutions across the globe whose major preoccupation is cyber-attacks on governments, 
corporate institutions and individuals, Again most individuals and groups thrive off cyber space through 
acts that are inimical to the future of society as regards cyber space: these are those whose perpetrate one 
criminal act or the other for malice or financial gain, in fact many individuals and groups live off this 
criminal act, and their population is on the rise. The ease and convenience by which violations in cyberspace 
are perpetrated and the huge gains to the perpetrators is an enormous motivation for the escalation of 
these attack and other threats. Amidst these attacks as well and its sundry devastating side effects which 
often results in monumental losses (financial and otherwise) the world is undeterred as it forges towards 


everyone become digital natives. 


In this study, a cursory look at the subsisting and persisting cyber threats and cyber related incidences are 
evaluated to show some of the trends that can be to used to forecast or predict what the future might hold 
for the cyber space and to advance recommendations to mitigate against threats and attacks. We need to 
be properly informed and guided an in our transition to becoming consummate digital natives. To 
accomplish this, data gathering from secondary sources was employed and used to piece together reliable 
information provided by distinguished institutions and firms that are committed to providing secure 


interactions in cyberspace and guaranteed survival of cyberspace. 


II. LITERATURE REVIEW 


In aworld driven more and more by big data, social networks and online transactions, information stored 
or managed via the internet and automated processes performed through the use of IT systems, 
information security and data privacy are permanently facing risks [17]. Critical Infrastructure Systems 
(CISs) which include sectors such as finance, transportation, oil, energy and water distribution, emergency 
services, health and government. These systems from the point of view of security are of increasing 
importance in both industrial and public domains [49]. They have to be highly resilient against cyber 
attacks and malicious activities, in order to reduce the risk of severe failures, as well as compromise of 
sensitive data. The criticality of such systems poses new challenges for computing professionals, which 
must develop more robust systems to ensure a high level of protection, and at the same time they must 
keep low costs and development time [18]. The scope of Cyber-attacks and threats keeps on stretching by 
the day: In October 2012, NATO identified an extensive espionage attack which was accredited to Russia 
and was going on for five years. This attack targeted European and Ukrainian government institutions [72]. 
Also in 2020, Iranian General and leader of the Quds group Qassem Suleimani was reported to have been 
killed by the Multi-Spectral Targeting System MQ-9 Reaper Drone [78]. Large retailers have also been 
targeted. this includes Target in December of 2013 [129] and Home Depot in mid-2014 [70]. 


The health sector also hasn’t been exempted from attacks as evidenced by the Anthem Health Insurance 
Breach [120]. Furthermore, in 2018 Singapore’s experienced its worst ever cyber-attack, when hackers 


got access to SingHealth’s system and stole the personal particulars of 1.5 million patients including Prime 
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Minister Lee Hsien Loong and a few other ministers [132]. This is in addition to the devastating 
"ransomware" called WannaCry that crippled computers in hospitals across the UK and cost the NHS £92m 


[50]. 


The Aviation industry has also seen its fair share of attacks over the years. In 2006, July a cyber attack 
forced the American Federal Aviation Administration to shut down several Air Traffic Control systems in 
Alaska [43] [86]. Equivalently, in August 2008 at Spain’s Madrid-Bajaras airport, a trojan in one of Span 
Air’s main computer systems blocks the reception and activation of an alarm message from flight No. 5022. 
This was cited among the causes of the plane’s collision and the loss of 154 passenger lives [38]. It has yet 
to be determined whether the systems were intentionally compromised through the Trojan [57]. Also, in 
March 2014 Malaysia Airlines flight MH370 disappears from tracking radar, and the Boeing 777-200ER is 
later given up for lost in an airline press release. In the overall uncertainty surrounding the event, it was 
also suggested that the plane had been commandeered by means of a mobile phone and/or a USB drive 


[38]. The theory has never been proven and has been roundly rejected by Boeing [155]. 


Cyber criminals have also targeted Government establishments numerous times over last few decades. In 
December 2015, in Ukraine, a cyber-attack was identified on multiple electricity distribution centres which 
caused power outages and affected approximately 225,000 customers [109]. Other attacks were carried 
out on call centres to stop customers to contact power the company and get help [72]. Also, in 2017 the city 
of Atlanta suffered an attack that locked down the city systems for over a week [19]. Similarly, a “logic 
bomb” was reportedly inserted in the Trans-Siberian pipeline’s control software to abnormally change the 
pumps and valves settings, causing a massive explosion in 1982 [108]. Perhaps the most famous cyber- 
attack on a government establishment was the “Stuxnet” virus between late 2009 and early 2010. This virus 
was allegedly responsible for destroying about 1,000 Iranian high-speed centrifuges used for Uranium 
enrichment, through periodically changing the rotational speed of the centrifuges, significantly shortening 


their lifespans [7]. 


The Hospitalities and Leisure Industry are also not immune to cyber-attacks. Not even the world’s largest 
hotel company could protect itself from cyber disaster [134]. In September 2018, Marriott hotels 
announced it had suffered a massive data breach affecting nearly 400 million customers to theft [113]. The 
breach started in 2014 and unfolded over years with attackers stealing contact information, passport 
numbers, arrival and departure dates, and reservation information. This breach represents one of the 


largest in history. 


Universities have also fallen victim to state-sponsored cyber-attacks. In March 2018, the U.S. government 
charged nine Iranians with stealing data and intellectual property from 300 domestic and foreign 
universities over a three-year period [40]. Reports estimate more than 31 terabytes of information worth 


more than $3 billion worth of intellectual property. “Spear-phishing” was used by the attackers to obtain 
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login information of university. More than 100,000 professors were targeted while 8,000 accounts were 
successfully infiltrated—almost half of which were accounts at U.S. schools. The alleged culprits are still 


believed to be in Iran. 


Another salient but important cyber threat issue, is that of privacy. While appearing minor in view of other 
cyber risks, privacy and personal data breaches heavily impact both consumers and organisations [56]. For 
instance, the average financial loss due to the theft of a single piece of private data is estimated to be 213 
USD [61] [149]. Cambridge Analytica came into the limelight for the first time in 2015. Ted Cruz utilized 
the company during his campaign. The world will later on learn about the use of personal data for Facebook 
users [37]. According to different media sources, Strategic Communications Laboratories, which is the 
parent company of Cambridge Analytica, was working with Global Science Research (GSR) [145]. GSR 
founder Kogan A. who at the time was head of data collection processes. He used Amazon Mechanical Turk, 
or MTurk, through which the users were presented with an opportunity to do routine and minimum paid 
job - Kogan offered the users to do online survey in exchange for the payment of 1-2$ [21]. In order to 
complete the survey, the users were asked to connect their Facebook accounts to the website [21]. This 
automatically led to unintentionally connecting Facebook “friends” of a user - the information of these 
“friends” became available for data collectors as well [151. This “seeding” technique proved to be very 
effective [145]. It was possible to get information about a huge number of people through one user. On 


average a single user brought around 340 “friends” according to the information based on 2014 statistics. 


User Information such as location and interest were gathered and analysed with the five-factor model - 
dispositional model of personality [61]. The analysis could unravel such traits of a person as extraversion, 
benevolence, conscientiousness, emotional stability and openness to experience, as well as their opposites 


[145]. Amazon has blocked GSR access to MTurk after numerous complaints [21]. 


Despite the increase in cybersecurity spending year after year by both the public-sector and private-sector, 
the number of cybercrime incidences keeps rising, and the growth of cybercrime appears no closer to being 
contained [145]. There are several challenges to countering cybercrimes: [11] law enforcers internationally 
are overwhelmed by the rampant spread of cybercrime and the rapid growth of dark web and underground 
cybercrime platforms. There is also the prevailing climate of a lack of efficient information sharing of cyber 
incidents between organizations due to non-disclosures, anti-trust or privacy laws. This has severely 
hampered the coordination levels observed among law enforcements across the borders [18]. Firms in the 
private sector are spending money almost exclusively in defending their own “four walls”, which does not 
address directly the external actors of cybercrimes [145]. Also, firms in many Asian countries choose to 
underinvest in cybersecurity due to partial externalization of data breach costs, and the absence of legal 
liability to protect vulnerable third parties who entrust their digital assets to firms for processing [145]. 
There is also a need for an integrated approach between private sector involvement and business solutions 


in order to counter cyber threats [52]. 
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No sector or industry is immune to cyber-attacks and while it is rare to find cyber-attacks that are similar 
it is imperative to understand the types of attacks, trends of attacks, the most targeted sectors, regions with 
the most persistent offenders as well as the type of defense/response utilized against various cyber threats. 
Multiple studies and surveys focus on specific cybercrime characteristics or develop classification models 
that do not adequately address the complexity of this contemporary type of crime [135]. An exploratory 
analysis is therefore imperative in order to come up with trends that could be insightful for individuals, 
corporations, and countries to measure not only the damages caused by cyber breaches, but also to provide 
a foundation for future comparisons one that can serve as a basis for proactive measures within industry 


and organizations. 


Related Studies 

[121] in their study titled “A cybersecurity framework to identify malicious edge device in fog computing 
and cloud-of-things environments” introduced a cybersecurity framework that identifies the malicious 
edge devices in the distributed fog computing environment through the two-stage Markov model namely 
Markov1 which is the first stage Markov model which calculates the attack probability of the edge device 
and its category. Markov? is the second stage Markov model which predicts whether the edge device should 
be shifted to Virtual Honey Pot Device (VHD) or not on the basis of information sent by Markov1, the 
framework has been tested with real attacks in virtual environment (through Open stack and Microsoft 
Azure). The experimental results indicate that the framework is successful in identifying but is restrained 


to preventing attacks from malicious edge device [121]. 


[135] introduced a comprehensive framework that sought to tackle cybercrime incidents. The framework 
involves an assesment of the severity of the attack threat which was done by a combination of frequency 
of: (i) appearance/reference and (ii) number of incidents. The framework also includes a detailed and 
relevant action plan for the relevant stakeholders involved in dealing with cybercrime. The study resulted 
in the creation of a comparison table of the top 15 cyber-threats and their trends. Each trend derives from 


the comparison of threat frequencies [135]. 


[31] presented a theory of insider threat assessment. They utilized a modelling methodology to capture 
several aspects of insider threat, and subsequently, show threat assessment methodologies to reveal 
possible attack strategies of an insider. The model was tested against a couple of common insider threat 


scenarios. 


[128] in their study developed a novel multi-layer cloud architectural model is to enable effective and 
seamless interactions/interoperations on heterogeneous devices/services provided by different vendors 
in IoT-based smart home. They also tried to solve the heterogeneity issues in the presented layered cloud 
platform, an ontology-based security service framework is designed for supporting security and privacy 


preservation in the process of interactions/interoperations. 
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[88] in their study sought to enhance the use of CVSS for vulnerability scoring, they utilized game theory to 
modelling an attacker-defender scenario and argue that, under the assumption of rational behaviour of the 
players, an effective vulnerability patching strategy could be achieved with an optimal strategy, solving the 
game. Their strategies were implemented as new functionality in the software tool CAESAIR. This research 
builds on our previous studies, where CVSS was used to inform the design of the utility functions, by 


performing the Nash equilibrium analysis of the game. 


III. DATA CLASSIFICATION AND DATA ANALYSIS 


Average Size of a Data Breach 


7 Year Average Size of a Data Breach 
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Figure 1: 7 Year Average Size of a Data Breach 
The average size of a Data Breach looks at the average number of total records per country/Region that 
have been compromised during a breach. The UAE & Dubai is out in front with a 5-year average of 32741 


breaches. The region has also seen a yearly increase in the number of breaches. 


India and also follow closely behind with a total 7-year average of 30873 breaches. India has also seen a 
consistent rise in the average number of yearly breaches. the United States make up the top three with a 7- 
year average of 29706 breaches despite having a decrease in 2015 and 2017, Brazil and France make up 


the remaining top 5 with France also experiencing a consistent yearly increase except for the year 2015. 


The bottom 5 countries/ regions are made up of Japan, South Africa, Italy, Australia and Canada with Japan 
having the lowest 7-year average of 19661 records despite having seen a yearly increase in all but 2018. 
South Africa and Canada also make the bottom 5 despite having a experienced a consistent yearly increase, 


although the average for those countries is 4 and 5 years respectively. 
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The top 5 countries/regions combine for an estimated population of 2 billion people while the bottom 
countries /region combine for an estimated 311 million people. This shows that in spite of advanced 
technology and sophistication, the sheer number of people corelates with the number of data breach 


attempts. 


Average Yearly Cost of a Data Breach 
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Figure 2 & 3: 7 Showing 7-year average industry cost of a data breach and average yearly cost of a 
data breach respectively 
The average yearly cost of a data breach shows the total average 7-year cost of a data breach from 12 


countries/regions. This total average peaked at an all-time high of 4$ in 2016. 


Average Industry Cost of a Data Breach 

The average industry cost of a data breach looks at the industries that have been most affected in terms of 
the average cost of a data breach. The healthcare which consists of hospitals and clinics sector surprisingly 
leads the line with a 7-year average cost of 361 $, the healthcare sector has also seen a yearly increase for 
all but one year (2016) of the stipulated time frame. the finance industry which consists of Banking, 
insurance and investment companies unsurprisingly came in at second with a 7-year average cost of 217$. 
Furthermore, the sector has also experienced a year-on-year increase for all but one of the stipulated time 
frame. The educational sector which consists of Public and private universities and colleges, training and 
development companies is third with a 7-year average cost of 209 $. The services industry which consists 
of (Professional services such as legal, accounting and consulting firms) and the communication sector 
which consists of Newspapers, book publishers, public relations and advertising agencies make up the top 
5. The industry with the least average cost of a breach is the public services industry which consists of the 
Federal, state and local government agenciesas well as NGOs with a 7-year average of 79$. The other 
industries that make up the bottom five includes industries such as the Research Industry (brick and 
mortar and e-commerce), the hospitality industry (hotels, restaurant chains, cruise lines), the media 
industry (Television, satellite, social media, Internet) and the transportation industry (Airlines, railroad, 


trucking and delivery companies). It can be seen that the heavily regulated industries such as healthcare, 
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financial and communications had a average data breach cost that is substantially higher than the less 


regulated industries such as retailers and the public sector industry. 


Detection and Escalation Cost 
These are costs associated with detection and escalation of data breach incidents. Such costs typically 
include forensic and investigative activities, assessment and audit services, crisis team management and 


communications to executive management and board of directors. 


Detection and Escalation Costs ($) Notification Costs ($) 
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Figure 3 & 4: Showing Detection and notification cost respectively 
Germany is out in front when it comes to detection and escalation cost with a 7-year average detection and 
escalation cost of 1,396,312. Unsurprisingly Germany also saw an increase in detection and escalation cost 
for 5 out of the 7-year period. France is next on the list with a 7-year average of 1,210,871. France also 
unsurprisingly saw an increase in detection and escalation cost for 4 out of the 7-year period. Italy, Japan 
and Australia complete the top 5 with a 7-year average of 1,109,696, 992,418 and 960,051 respectively. 
Brazil has the least detection and escalation cost out of the designated countries/regions with a 7-year 
average of 412,999 Surprisingly, Brazil saw an increase in detection and escalation cost for 4 out of the 7- 
year period. They are closely followed by India with a 7-year average of 475,521. India has also seen an 


increase in 5 in out of the 7-year period. The United States completes the bottom 3. 


Notification Cost 

These are all the costs associated with notification activities in the event of a data breach. Such costs 
typically include IT activities associated with the creation of contact databases, determination of all 
regulatory requirements, engagement of outside experts, postal expenditures, secondary contacts to mail 
or email bounce-backs and inbound communication set-up. The US sample experienced the highest 
notification cost. The United States is out in front when it comes to detection and escalation cost with a 7- 
year average of 625,499. Unsurprisingly, the United States has seen an increase in notification cost for 5 
out of the 7-year period. Germany is next on the list with a 7-year average of 294,885. Germany also 
unsurprisingly saw an increase in notification costs for 4 out of the 7-year period. The United Kingdom, 


France and Japan complete the top 5 with a 7-year notification average of 231,626, 115,431 and 80,170 
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respectively. India has the least notification cost out of the designated countries/regions with a 7-year 
average of 23,702. Surprisingly, Brazil has seen an increase in notification cost for 3 out of the 7-year period. 


They are closely followed by Brazil with a 7-year average of 44,658. Australia completes the bottom 3. 


IV. FUTURE TRENDS 


Evolution of Cybercrime/Cybercriminals 

In the coming decade cybercriminals will modify, adapt, and diversify their attack strategies states, this is 
will happen despite the increased actions of law enforcement actions against cybercriminals and crime 
syndicates in the past decade, Furthermore, an increased maturity and resilience among threat actors will 
ensure that they remain operational despite the clampdown by various law enforcement and agencies. A 
closer exploration also indicates that conventional cybercrime and financially-motivated, targeted attacks 
will continue to pose a significant threat to corporations, businesses as well as individual users and. 
However, criminal operations will likely continue to alter their techniques in order to reduce the risk of 
exposure, detection and disruptions. Cybercriminals will also seek to capitalize and streamline their efforts 
in several ways such as: moving away from partnerships to operating within close-knit syndicates; 
leveraging on the familiarity and exposure with local environments; using third parties to sell and buy 
direct access to networks for ransomware attacks instead of carrying out advanced intrusions, increasing 


the accuracy of targeting by using valid documents to prime out possible victims before attacking. 


Rising Vulnerability of Cloud Infrastructure 

The middle east/Africa sub region has seen a 42% rise in exabytes of cloud data within the study period. 
Africa’s shortcomings in wired infrastructure has made the region a good place for cloud adoption [64]. 
One of the key results of the lack of decent and affordable wired services is that people have instead adopted 
mobile application services [64]. In some cases, mobile applications of certain types have usage statistics 
that dwarf even the US’s [152]. An example is Safaricom’s M-PESA mobile payment system, which provides 
a way for customers to transfer money to each other through mobile phones [152]. Compared to wired 
infrastructure, the deployment of mobile bandwidth in Africa is significantly easier, both from a financial 
and cultural perspective [152]. A recent World Bank study even revealed that 97 percent of Africa’s 
population can be covered by mobile without the need for any government subsidy [152]. Furthermore, 
the discovery of multiple side-channel vulnerabilities in modern CPUs over the last two years could pose a 
high risk to organizations running their compute infrastructure in the public cloud [115]. Adversaries can 
use this class of side-channel vulnerabilities to read sensitive data from other hosts on the same physical 


server [115]. 


Rise in Geopolitical Tensions 
The very beginning of 2020 was marked by a sudden increase in tensions between Iran and the U.S., 
including military action undertaken on both sides [36]. Although rhetoric de-escalated by mid-January, 


hacktivism, disinformation campaigns on social media, as well as an elevated risk of targeted intrusions 
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(including destructive attacks) will go into the future [36]. Global businesses may find themselves in the 
crosshairs as geopolitical tensions persist [5]. As cyberthreat actors take advantage of high-profile global 
events and seek to influence mass opinion, we can expect these actors to not only sustain current levels of 
activity but also to take advantage of new capabilities as new technologies enable more-sophisticated 


threat TTPs [5]. 


Rise of the Insiders 

Over the years a lot of attention and resources have been devoted to malicious/criminal attack and with 
good reason as well, as this category of attack has seen a year-on-year increase for all but one year during 
the 7-year period. However, the combined categories of system glitches and human errors do in fact 
account for a higher cause of breaches over a 7-year period. This indicates that as much as attacks from 
external actors shouldn’t be neglected, a lot of damage can be done from internal actors either inadvertently 
or otherwise. This is a trend that will undoubtedly persist into the next decade unless novel strategies can 


be deployed to combat them. 


The Healthcare Frontier 

The healthcare which consists of hospitals and clinics sector has consistently ranked high in tserms of the 
data breach cost. The industry has 7-year average data breach cost of 361 $, the healthcare sector has also 
seen a yearly increase for all but one year (2016) of the stipulated time frame. With the scramble to develop 


and distribute vaccines in a post pandemic world. This industry will continue to be among the hardest hit. 


V. CONCLUSION 


When Robert Metcalfe made his popular prediction that sought to explain how networks will spread in in 
the future, it was deemed audacious. In what is popularly referred to as the Metcalfe law which states that 
the value of a network is directly proportional to the to the square of is number of users [116], it was 
considered ludicrous. That prediction has now been surpassed as networks have become invaluable and 
totally indispensable. Modern day existence is now principally hinged on networks, a substantial part of 


daily transactions worldwide is conducted and supported by computer networks. 


Networks are an integral part of the business, social, economic and political aspects of states, corporate 
entities, individuals etc. The Cybersecurity and Infrastructure Agency of the USA, identified 16 critical 
infrastructure sectors whose assets, systems, and networks, whether physical or virtual, are considered so 
vital to the United States and the world thereof that their incapacitation or destruction would have a 
debilitating effect on security, economy, national public health or safety, or any combination thereof. These 
Critical Infrastructure Systems (CISs) which involve sectors such as energy, finance, food and agriculture 
transportation, healthcare, public health, oil, gas, water distribution, government and emergency services 
have all become almost completely reliant on computer networks [49]. As nations target other nations 


infrastructure, and as competitors target each other’s corporate information and as hackers intensify their 
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criminal and malicious attacks. A paradigm shifts in addressing and mitigating possible cyber-attacks has 


become germane. 


Consequently, this study advocates and supports the call for the development of a multidisciplinary, and 
transdisciplinary based strategies to contain the threats that have persisted and have seemingly defied 
existing solutions. Studies that can help to develop veritable, multidisciplinary, transdisciplinary 
frameworks upon which future strategies will depend have become imperative. also, treaties, effective 
legislation, appropriate sanctions and the need for nations, corporate institutions, and individuals to be 


take responsibility as well as be held accountable have become indispensable. 
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